All checks
Medium
RDS Database Clusters should use a custom administrator username
Flags RDS database clusters whose master username is admin, root, sa, oracle or postgres, in any letter case. These are the names tried first, so a cluster using one leaves an attacker only the password to guess.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Replaces the resource: No modify or restore changes the master username: create a new cluster with a custom one, move the data with the engine's dump and load tools, repoint clients, then delete this one.
In the console
RDS → Create database → Settings → Credentials Settings
- Master username
- A name other than admin, root, sa, oracle or postgres
With Terraform
resource "aws_rds_cluster" "this" {
engine = var.engine
master_username = var.master_username
}See which of your accounts this check is failing on.
Book a live scan